CVE-2026-54495

Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented {NAMESPACE}/{NAME} syntax. The operator resolves the referenced resource cluster-wide and materializes its contents (env vars, flagd sidecar arguments including httpSyncBearerToken, sync URIs, supporting ConfigMaps) into the referencing workload. On multi-tenant clusters that treat namespaces as trust boundaries, a tenant who can deploy a controller-owned workload in their own namespace can cause the operator to read another tenant's FeatureFlagSource / InProcessConfiguration spec contents. Impact - Single-tenant clusters: not impacted. - Multi-tenant clusters using namespaces as trust boundaries: tenant-to-tenant disclosure of any data placed inline in FeatureFlagSource / InProcessConfiguration spec, including spec.envVars literal values, spec.httpSyncBearerToken, and sync URIs. Behavior is documented The cross-namespace {NAMESPACE}/{NAME} annotation syntax is intentional and documented in docs/annotations.md and docs/feature_flag_source.md. The operator's cluster-wide RBAC scope is intentional. Namespace-as-trust-boundary is not part of the operator's current stated security model. This advisory makes the tenancy assumption explicit and tracks the architectural change that will eliminate the implicit cross-namespace pattern. Corrections to the original report Two technical points in the original report require correction: 1. secretKeyRef / configMapKeyRef cross-namespace disclosure is not possible via this path. Kubelet resolves these as LocalObjectReference against the pod's own namespace; the operator does not bypass that. The actual disclosure surface is FeatureFlagSource / InProcessConfiguration spec contents the operator itself materializes (inline envVars values, httpSyncBearerToken, sync URIs). 2. create featureflagsources is not a prerequisite. The webhook rejects pod

[![CVE-2026-54495 status](https://www.csirts.com/badge/CVE-2026-54495)](https://www.csirts.com/cve/CVE-2026-54495)